Loading malware…
plain-crypto-js is a malicious npm package used in a March 2026 software supply-chain compromise involving poisoned Axios releases. Masquerading as a legitimate JavaScript cryptography library, it was inserted as a hidden dependency whose sole purpose was to execute a postinstall script during package installation. That script acted as a cross-platform dropper for a remote access trojan targeting Windows, macOS, and Linux systems, including developer workstations and CI/CD environments that resolved the compromised dependency.
The package used obfuscated Node.js code to detect the host operating system, contact attacker-controlled command-and-control infrastructure, and retrieve platform-specific second-stage payloads. Reported payload implementations included a PowerShell-based RAT on Windows, a Mach-O backdoor on macOS, and a Python-based RAT on Linux. Across platforms, the malware supported remote command execution and additional payload delivery, and was reported to perform reconnaissance, establish persistence, communicate periodically with command-and-control servers, and remove or replace local installation artifacts to hinder forensic analysis. Observed command support included execution of scripts and directories, process termination, and injection-related functionality.
plain-crypto-js was distributed transitively through malicious Axios versions published after compromise of a maintainer npm account, causing installation to occur automatically when affected package versions were installed. The campaign was assessed as high impact because Axios is a widely used dependency across the JavaScript ecosystem, creating downstream exposure across enterprise development pipelines and multiple industry sectors. Reporting linked the malware’s tooling and infrastructure to WAVESHAPER overlaps, and public attribution by major vendors associated the broader Axios compromise with North Korea-linked activity tracked as Sapphire Sleet and UNC1069.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These versions introduced a phantom dependency -- plain-crypto-js@4.2.1 ... a package that had not existed before that day and is never actually imported by axios code. Its sole purpose was to execute a postinstall script that drops and runs a cross-platform RAT targeting macOS, Windows, and Linux.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
macOS: The dropper uses AppleScript... launches it silently via /bin/zsh. Windows: ... uses VBScript to fetch and execute a secondary PowerShell RAT script... Linux: The dropper uses the Node.js execSync command to download a Python RAT script...
Windows: The dropper searches for and copies the legitimate Windows PowerShell binary to %PROGRAMDATA%\wt.exe. It then uses VBScript to fetch and execute a secondary PowerShell RAT script, which is subsequently executed by wt.exe.
macOS: The dropper uses AppleScript to download a C++ compiled Mach-O binary, saves it to /Library/Caches/com.apple.act.mond, makes it executable and launches it silently via /bin/zsh.
Windows: ... It then uses VBScript to fetch and execute a secondary PowerShell RAT script...
Linux: The dropper uses the Node.js execSync command to download a Python RAT script to /tmp/ld.py, running it in the background using the nohup command.
plain-crypto-js, which included a postinstall script that ran a setup.js script via node. When developers or CI pipelines run npm install axios@1.14.1, NPM resolves the dependency tree, downloads plain-crypto-js@4.2.1, and runs the postinstall script. Running node setup.js triggers the compromise sequence.
Once installed, npm automatically ran post-install scripts tied to the dependency.
This triggers npm's postinstall lifecycle hook, executing a heavily obfuscated Node.js dropper script named setup.js in the background.
a malicious dependency named "plain-crypto-js", an obfuscated dropper that deploys the WAVESHAPER.V2 backdoor
To make this outbound traffic look like benign npm registry requests, it appends platform-specific paths: packages.npm[.]org/product0 for macOS ... All the RAT variants use a hard-coded... user-agent string spoofing Internet Explorer 8 on Windows XP
The C2 server accepts the same four commands from the attacker: kill (self-terminate) runscript (execute shell/script commands) peinject (drop and execute binary payloads) rundir (enumerate directories)
After launching the second-stage payload, the installer logic removes its own loader ( setup.js ) and removes the manifest ( package.json ) that contained the install trigger.
Upon successfully launching the payload, the Node.js dropper performs aggressive anti-forensic cleanup. It deletes the setup.js file, removes the postinstall hook and replaces the tampered package.json with a clean decoy file named package.md .
After launching the second-stage payload, the installer logic removes its own loader ( setup.js ) and removes the manifest ( package.json ) that contained the install trigger. It then renames package.md to package.json , leaving behind a clean-looking manifest
This triggers npm's postinstall lifecycle hook, executing a heavily obfuscated Node.js dropper script named setup.js in the background.
During execution, the malware contacts command-and-control (C2) infrastructure at sfrclak[.]com to deliver platform-specific payloads, then deletes itself and replaces its package.json with a clean version to evade detection.
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious dependency injected during the Axios supply-chain compromise; it installed a remote access trojan on impacted environments.
A malicious npm package used in the Axios supply-chain compromise. It executes a postinstall script that drops a cross-platform remote access trojan for macOS, Windows, and Linux, performs reconnaissance, establishes persistence, communicates with a live C2 server, and includes self-deletion for evasion.
A cross-platform remote access trojan introduced via malicious Axios package updates. It was designed to perform system reconnaissance, establish persistence, and then self-destruct to evade forensic detection.
A malicious fake npm dependency inserted into compromised Axios releases that used a postinstall hook to fetch and deploy a cross-platform remote access trojan on Windows, macOS, and Linux.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.